在AWS S3 IAM策略中指定多个文件夹

Question

I guess that my question is pretty straightforward. Let's say that I have following S3 bucket structure.

- root_folder_bucket
  - subfolder1
  - subfolder2
  - subfolder3
  - somefolder

The naive approach to restrict access only, for example, subfolder1, subfolder2, and subfolder3 would be like bellow. In fact, AWS wouldn't throw an error, but such policy will not work. Is there any elegant way to write the Resource policy like bellow or I should stick to the prefixes, conditions, and delimiter?

"arn:aws:s3:::root_folder_bucket/[subfolder1, subfolder2]/*",

Answer 1

Instead of defining the subfolders in a single ARN (Which won't work), you can either add multiple statements to the policy life shown below,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::root_folder_bucket/subfolder1"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::root_folder_bucket/subfolder2"]
    }
  ]
}

Or add multiple ARNs to the Resource block,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::root_folder_bucket/subfolder1",
                   "arn:aws:s3:::root_folder_bucket/subfolder2"]
    }
  ]
}